CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
libstagefright in Android before 5.1.1 LMY48Z and 6.0 before December 1, 2015, allows attackers to gain privileges via a crafted application. This can lead to obtaining Signature or SignatureOrSystem access.
The kernel in Android before 5.1.1 LMY48Z and 6.0 before December 1, 2015, allows attackers to gain privileges via a crafted application.
Skia, as used in Android before 5.1.1 LMY48Z and 6.0 before December 1, 2015, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
A vulnerability in mediaserver in Android before version 5.1.1 LMY48Z and 6.0 before December 1, 2015, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
Symfony versions 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 may be vulnerable to remote attacks via a timing attack. This affects classes related to token persistence and the CSRF implementation in the form component.
Huawei USG5500, USG2100, USG2200, and USG5100 unified security gateways with software before V300R001C10SPC600, when 'DHCP Snooping' is enabled and either 'option82 insert' or 'option82 rebuild' is enabled on an interface, are vulnerable to remote attacks that can cause a denial of service (reboot) via crafted DHCP packets.
The iControl API in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM before version 11.5.3 HF2 and 11.6.0 HF6, as well as in other components, allows remote authenticated users with the 'Resource Administrator' role to gain elevated privileges via iCall scripts or handlers in a SOAP request.
The do_write_pids function in lxcfs.c in LXCFS before version 0.12 does not properly check permissions, allowing local users to gain privileges by writing a pid to the tasks file.
The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name.
In OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e, a vulnerability allows remote attackers to cause a denial of service via an RSA PSS ASN.1 signature that lacks a mask generation function parameter.
The Montgomery squaring implementation in OpenSSL 1.0.2 before 1.0.2e on the x86_64 platform mishandles carry propagation, leading to incorrect output. This makes it easier for remote attackers to obtain sensitive private-key information via an attack against the use of (1) Diffie-Hellman (DH) or (2) Diffie-Hellman Ephemeral (DHE) ciphersuite.
The VideoFramePool::PoolImpl::CreateFrame function in Google Chrome before version 47.0.2526.73 does not initialize memory for a video-frame data structure, which might allow remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact.
CVE-2015-8479 is a use-after-free vulnerability in the AudioOutputDevice::OnDeviceAuthorized function in Google Chrome before version 47.0.2526.73. It allows attackers to trigger a denial of service by accessing an unauthorized audio output device, potentially leading to heap memory corruption.
Multiple unspecified vulnerabilities in Google V8 before version 4.7.80.23, as used in Google Chrome before version 47.0.2526.73, may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Multiple unspecified vulnerabilities in Google Chrome before version 47.0.2526.73 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Integer overflow in the FontData::Bound function in Google sfntly, used in Google Chrome before version 47.0.2526.73, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted offset or length value within font data in an SFNT container.
The CJBig2_SymbolDict class in PDFium, used in Google Chrome before version 47.0.2526.73, allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via a PDF document containing crafted data with JBIG2 compression.
A use-after-free vulnerability in the ContainerNode::notifyNodeInsertedInternal function in the DOM implementation in Google Chrome before version 47.0.2526.73 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to DOMCharacterDataModified events for certain detached-subtree insertions.
In PDFium, used in Google Chrome before version 47.0.2526.73, the fxjs_v8.cpp file does not use signatures, allowing remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage 'type confusion.'
A use-after-free vulnerability in the GetLoadTimes function in the Extensions implementation in Google Chrome before version 47.0.2526.73 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that modifies a pointer used for reporting loadTimes data.